On the Team tab of Settings → Users & Roles:
Change roles
Choose Edit access on the member, tick or untick roles, and save. You can only give roles whose permissions you hold, and you can't change your own.
Disable
Disabling stops someone signing in to this tenancy without removing them. Enable them again at any time.
Remove
Remove takes someone out of the tenancy: they're disabled and lose all their roles and workflow roles. Their history stays, so records still show who did what. If they're invited again later, they come back as the same member.
Who can't be removed
The owner: transfer ownership first.
The person who pays for the subscription the tenancy is on.